Friendly Fire: how AI coding agents get tricked into running someone else's code during auto-review

What does the research show?

The researchers built a repository whose README.md disguises a binary as a “legitimate Go build” and, in the body text, suggests running a security.sh script — ostensibly for verification. When an AI coding agent in auto-mode “reviews” this repository, it follows the instruction hidden in the documentation and executes the payload autonomously, without human approval. Both Claude Code and OpenAI Codex were affected, across multiple tested model versions — the effect isn't an isolated quirk of one model but a pattern tied to the “auto-review”/“auto-mode” functionality itself.

How does the attack work?

At its core this is classic prompt injection applied to a tool with execution rights: an agent reading files to understand a repository treats the contents of README.md as trusted context — including instructions that have no business being there. Combined with the ability to execute commands (say, to build tests or verify build steps), a plausible-sounding instruction like “run security.sh to verify” is enough to launch the payload. The agent does not reliably distinguish between legitimate project documentation and an attacker's embedded commands — the same pattern already documented in the Miasma and “Comment and Control” cases on this blog.

Why it matters

The finding hits a growing use case particularly hard: AI agents routinely tasked with “automatically” checking third-party code or pull requests for security risks — exactly the use case where trust in unknown code matters most. When the review agent itself becomes the execution environment for the code under review, the protective function inverts. For teams that give AI agents production access (deploy keys, CI secrets, cloud credentials), this isn't an abstract risk: a successfully injected agent potentially has the same rights as the agent itself.

What to do now

Immediate steps

• Avoid auto-mode/auto-review for reviewing untrusted third-party code — require manual approval for every command execution.
• Sandbox agents with execution rights as a baseline — even though containment is described as “imperfect” in the study, it reduces blast radius.
• Set up monitoring for agents executing binaries that are only referenced in documentation (README, comments) rather than the actual build process.
• Don't delegate code security reviews with execution rights on production systems to agents as a rule.

Decision block

Act now if: you use AI coding agents in auto-mode against unknown/external code, especially with access to secrets or production systems. Monitor if: agents run exclusively with manual per-command approval in isolated environments.

Conclusion

“Friendly Fire” is further evidence that the biggest weakness in many AI agent deployments isn't the model — it's the combination of automatic execution and uncritical trust in external text. For security reviews specifically: anyone deploying AI agents exactly where unknown code needs checking should consistently avoid auto-mode and tie command execution to human approval.

Sources

• The Hacker News — Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It (9 Jul 2026)